Current sub-processors
| Sub-processor | What it does for us | Personal data involved | Location |
|---|---|---|---|
| Salesforce, Inc. | Our own CRM. Holds our lead and customer records and receives submissions from the early access form on our website. | Business contact details: name, work email address, company, and our correspondence history with you. | United States |
| InMotion Hosting, Inc. | Hosting for this website, and our business email. | Server access logs (IP address, user-agent, pages requested) and the content of email correspondence, including any support material you send us. | United States |
Each is bound by written terms requiring it to process personal data only on our instructions and to protect it to a standard no less protective than our Data Processing Addendum. We remain responsible to you for their performance.
Commonly asked about, but not sub-processors
The parties listed below are sometimes mistakenly considered sub-processors, but they are not. They either process data on behalf of you directly, or they do not process any personal data at all.
| Party | Why it is not our sub-processor |
|---|---|
| Salesforce, Inc. as your platform provider | Salesforce appears above only as our own CRM vendor. In its capacity as the platform hosting your org, Salesforce is your processor under your agreement with Salesforce. The ControlLayer package runs inside your org under that relationship, and we are not a party to it. |
| Microsoft Corporation (Azure DevOps) | We use Azure DevOps to build and deploy this website. It handles our source code and deployment pipeline only. No customer or visitor personal data passes through it. |
What is deliberately absent
This site runs no analytics provider, no advertising or retargeting network, no third-party font or CDN, no chat widget, no session recording tool and no marketing automation platform. Each of those would be a sub-processor, and each would appear in the table above if it existed. The list is short because the stack is.
How we announce changes
Under section 7 of the DPA, we give at least thirty (30) days' notice before adding or replacing a sub-processor. Notice is given by updating this page and emailing the contact we hold for each customer. Customers may object on reasonable data protection grounds within that period; the DPA sets out what happens then.
To be added to the notification list, or to raise a question about anyone named here, email privacy@controllayer.app.